Incidents

A Web of (Mis)Trust?

At our international press tour held in Moscow in early February, we spoke about the dissolution of trust on the internet and discussed
the possibility of Certificate Authority subversion and the impact of abused digital certificates.

Our speculation was partly driven by the abuse of trust that Kaspersky Lab monitored and prevented by the stolen Stuxnet digital certificates.

This unfortunate moment is arriving sooner than we wanted. This past week, another concrete example of the very foundation of trust on the web was shaken with the final coordination of an effort between a compromised Certificate Authority and web browser providers. The compromised Certificate Authority and browser developers needed to denylist a set of digital certificates for high value sites that malicious attackers issued for their own use. The end result is that attackers assumed the credibility of some major web presences with the assurance of the Certificate Authority. Mozilla provided brief description of impact: “Users on a compromised network could be directed to sites using the fraudulent certificates and mistake them for the legitimate sites. This could deceive them into revealing personal information such as usernames and passwords. It may also deceive users into downloading malware if they believe it’s coming from a trusted site.”

What does that mean to you? Well, a short list of some of the impacted sites include:
login.live.com
mail.google.com
www.google.com
login.yahoo.com (3 certificates)
login.skype.com
addons.mozilla.org
“Global Trustee”

In a hypothetical scenario, you may have received an email with a link that you clicked on, or your browser may have been redirected to what appeared to be one of these sites. The browser indicated that it trusts the site, so you login with your user and pass. For some reason, you get redirected and login again to the site. At this point, a part of your online identity and access to your email or IM is compromised by an attacker. Again, this is purely hypothetical.

In followup to the event, a crlwatch project has been announced within a corresponding lengthy writeup on the technical matters of the incident.

The crlwatch project itself will help monitor the revocation of certs in response to breaches like this one.

More data is being provided as I write this post. It will be updated as more details come in.

A Web of (Mis)Trust?

Your email address will not be published.

 

Reports

Kimsuky’s GoldDragon cluster and its C2 operations

Kimsuky (also known as Thallium, Black Banshee and Velvet Chollima) is a prolific and active threat actor primarily targeting Korea-related entities. In early 2022, we observed this group was attacking the media and a think-tank in South Korea.

Andariel deploys DTrack and Maui ransomware

Earlier, the CISA published an alert related to a Stairwell report, “Maui Ransomware.” Our data should openly help solidify the attribution of the Maui ransomware incident to the Korean-speaking APT Andariel, also known as Silent Chollima and Stonefly.

Subscribe to our weekly e-mails

The hottest research right in your inbox